WordPress Plugin Vulnerabilities

Helios Solutions Brand Logo Slider <= 2.1 - Authenticated Arbitrary File Upload

Description

An Authenticated user (admin+) can bypass the security check of the plugin and upload arbitrary files via the Brand Logo.

Proof of Concept

Affects Plugins

Plugin icon
hs-brand-logo-slider
No known fix

References

Exploitdb
48913

Miscellaneous

Original Researcher
Net-Hunter
Verified
Yes
WPVDB ID
3aab3cab-13bf-4423-a2d3-e23dbc71c5c2

Timeline

Publicly Published
2020-10-21 (about 5 years ago)
Added
2020-10-21 (about 5 years ago)
Last Updated
2020-11-03 (about 5 years ago)

Other

Published
Title
Published
2021-08-16
Title
Simple eCommerce <= 3.1.2 - Arbitrary File Upload
Published
2025-05-21
Title
MapSVG - All Kinds of Maps and Store Locator for WordPress <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-06-17
Title
Pixabay Images <= 3.4 - Authenticated (Author+) Arbitrary File Upload
Published
2016-09-19
Title
Front end file upload and manager Plugin < 4.0 - Arbitrary File Upload
Published
2016-06-22
Title
Contus Video Comments - Unauthenticated Remote JPG File Upload